[rules-users] How to obtain the timestamp of an event if I don't use an @timestamp attribute?